While poking with my "bricked" Kindle Touch, I've found a way to enable "USB downloader" boot mode of Freescale i.MX508 MCU used in a device.

When mode is enabled, Kindle is recognized as USB HID device with VID 0x15A2 and PID 0x0052. It should be possible to connect to it via custom Serial Download Protocol designed by Freescale and described in MCU Reference Manual. Protocol allows to read/write memory, upload program image into RAM and start executing at given address.

To enable this mode one should perform "hard reset" with pressed Home button. Hold Home button, then perform "hard reset" by holding Power button for 20 seconds and releasing it. Then wait about a second or two and release Home button. That's all.

It's easier to follow with Kindle connected to computer. After 20 seconds of holding Power button, Kindle USB disk should be detached from computer. It's time to release Power button. Then Kindle should be recognized as USB HID device. Now Home button could be released.

With loading arbitary code to RAM and executing it, this mode could be used as base for the ultimate unbricking solution, so I'm pretty excited about it. But it could be just a useless discovery if any restrictions will be revealed in further exploration.

When I tried that a couple of days ago, Windows automatically installed two different HID device drivers for it. They must be built into Windows XP. I also downloaded some tools and source code to use it.

Android supports running the system on NFS root file system. You can put the total Android root system into NFS, but you need to load the kernel image from the TFTP server. Therefore, you must have a PC that has NFS and TFTP servers, with their root directory set up correctly, that is, /opt/tftproot for TFTP root, and /opt/nfsroot for NFS root.

That looks pretty exciting to me! Besides being a potential recovery method, it may be usable for other things if needed later (mp3 replacement, for example).

Most importantly, I am providing tools to recover bricked kindles, which have been used successfully by mutliple kindle owners. I am also working on extensions to this for root access, jailbreak, and application installations. I plan to provide support for Kindle 3 and earlier as well.

Most importantly, I am providing tools to recover bricked kindles, which have been used successfully by mutliple kindle owners. I am also working on extensions to this for root access, jailbreak, and application installations. I plan to provide support for Kindle 3 and earlier as well.

And for people who have not (yet) bricked their kindle - the USB-serial mode should be available during "normal" operation also.

Anyway -
What that says is the USB port is put into 'serial mode' on the loading
of the kernel's g_serial module.

Note:
The Kindle-3.2.1 system build does not include usb_modeswitch, might be a nice thing to add to the system images.

Minor correction -
What that says is that it sends an even notification using lipc to anything that is listening for the event.Note: just gotta get rid of that propritary lipc thing using an opensource equivalent.
(Contractors often do that, re-invent standard software - it pays more.)

But the root cause is the same, loading of the kernel module.

Don't see anything in the gaget driver itself that sets the line speed:

And click 'files' in the breadcrumb trail to get at the init and config files.

Nice. Thanks. I see opie in the breadcrumb trail. I actually booted that up on my Palm Tx a few weeks ago. It was sitting on a shelf gathering dust for a few years, and I needed to drop in and say "hello" to it when some folding serial keyboards arrived from ebay...

But now that we know that kindles have OTG external USB ports, we can use USB keyboards when we figure out how to switch modes.